Privacy Policy

1. Data we collect

We collect only what we need to deliver a high-quality, secure service.

• Account data: name, email, company, role, and authentication credentials.
• Usage data: pages viewed, product actions, technical logs, IP, device, and browser.
• Integration data: metadata and content from repositories, issues, documents, and infrastructure you connect (e.g., GitHub, Jira, Notion, AWS), only with your explicit OAuth authorization.
• Payment data: processed by our payment providers; we do not store full card details.
• Communications: messages sent to support and survey responses.

2. How we use your data

• Operate, maintain, and improve the Service, including plan generation, code reviews, and alerts.
• Personalize technical recommendations based on your project context.
• Ensure security, prevent fraud, and meet legal obligations.
• Send transactional communications and, with your consent, marketing communications.

3. AI and large language models

Hire Archon uses proprietary and third-party AI models (LLMs) to analyze context and generate recommendations.

• By default, we do NOT use your customer data to train general-purpose AI models.
• Model providers are engaged under Data Processing Agreements (DPAs) that prohibit retention for training.
• AI-generated outputs are suggestions and must be reviewed by humans before any production execution.
• You may opt out of any optional AI feature at any time.

4. Data sharing

We share data only with service providers strictly necessary to operate the product (hosting, observability, email, payments, AI providers), all under contract and confidentiality terms. We do not sell personal data.

5. International transfers

Some subprocessors may be located outside the EU or Brazil. In such cases we apply safeguards such as Standard Contractual Clauses and equivalent mechanisms under GDPR and LGPD.

6. Retention and deletion

We retain data only as long as needed to fulfill the purposes described or as required by law. Upon account closure, personal data is deleted or anonymized within 90 days, unless legal retention applies.

7. Security

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls (RBAC) and multi-factor authentication for administrators.
• Audit logging and continuous security monitoring.
• Incident response plan with notification to authorities and data subjects when applicable.

8. Your rights

You may request access, correction, portability, deletion, information about sharing, and withdrawal of consent. We respond within 30 days (15 days under LGPD).

9. Cookies

We use essential cookies for authentication and analytics cookies to understand product usage. You can manage cookie preferences in your browser.

10. Children

The Service is not intended for individuals under 18. We do not knowingly collect data from children.

11. Updates to this Policy

We may update this Policy periodically. Material changes will be communicated via email or in-product at least 15 days in advance.